feat(v26.3-Alpha.2): bytecode pre-optimization engine with disk cache

aprism.agent.optimize package in aprismate-agent:
- AsmClassOptimizer: two ASM core-API passes (void-call elision via
  stack-safe argument pops; method-entry probe injection to ProbeSink)
- PreOptimizationTransformer: ClassFileTransformer, fail-open (any
  Throwable -> null = original bytes), JDK-internal packages excluded
- BytecodeCache: SHA-256 keyed, integrity-framed [hash][payload]
  entries, atomic writes, corrupt->miss degradation
- OptimizerConfig: simple line-format rules file parsed at premain;
  opt-in via -Daprismate.optimizer.rules=<file>; absent = no-op
- embedJar now bundles ASM from runtimeClasspath (~214 KB total)

Design: engine in agent module (not api) because ASM must NOT enter
the jdk.aprismate fork module; agent jar is plain classpath artifact.

Bugs found by tests and fixed:
1. slash/dot mismatch between ASM internal names and rule keys
   (all comparison points normalize)
2. elision gate was class-scoped but call targets live in any class
   (replaced with cheap pre-scan visitor sweep)
3. cache had no integrity check (corrupt files returned as-is)
4. Properties.load backslash escaping ate Windows test paths

33 new tests including real define-and-execute of transformed bytes
via ByteArrayClassLoader. Full suite: 704 tests, 0 failures.

Author: StarsailsClover

aprismate-agent/build.gradle

@@ -46,6 +46,15 @@ tasks.register('embedJar', Jar) {
     }) {
         exclude 'module-info.class'
     }
+    // bundle ASM: the optimizer needs it at runtime on any host JDK
+    configurations.runtimeClasspath
+        .filter { it.name.startsWith('asm') }
+        .each { dep ->
+            from({ zipTree(dep) }) {
+                exclude 'module-info.class'
+                exclude 'META-INF/*'
+            }
+        }
 }
 
 shadowJar {

aprismate-agent/src/main/java/aprism/agent/optimize/AsmClassOptimizer.java

@@ -0,0 +1,181 @@
+package aprism.agent.optimize;
+
+import org.objectweb.asm.ClassReader;
+import org.objectweb.asm.ClassVisitor;
+import org.objectweb.asm.ClassWriter;
+import org.objectweb.asm.MethodVisitor;
+import org.objectweb.asm.Opcodes;
+import org.objectweb.asm.Type;
+
+import java.util.Set;
+
+/**
+ * ASM core-API optimizer. Two passes over the original bytes:
+ *
+ * <ol>
+ *   <li><b>elision</b> — void method invocations whose owner+name match
+ *       the rule set are replaced by argument pops (stack-safe for void
+ *       descriptors; non-void targets are never matched).</li>
+ *   <li><b>probe-enter</b> — a static
+ *       {@code ProbeSink.methodEnter(Ljava/lang/String;)V} call is
+ *       injected at the entry of methods matching the rule set, with
+ *       the tag {@code "internal.Owner.methodName"}.</li>
+ * </ol>
+ *
+ * COMPUTE_MAXS is sufficient (we only pop what we pushed / remove
+ * balanced calls); frames are recomputed via COMPUTE_FRAMES for safety
+ * on class-file version 50+.
+ */
+public final class AsmClassOptimizer {
+
+    private final OptimizerConfig config;
+
+    public AsmClassOptimizer(OptimizerConfig config) {
+        this.config = config;
+    }
+
+    /**
+     * Transforms bytes; returns null when nothing matched (caller passes
+     * original through unchanged).
+     */
+    public byte[] transform(String className, byte[] input) {
+        if (config.isEmpty()) {
+            return null;
+        }
+        ClassReader cr = new ClassReader(input);
+        String internal = cr.getClassName();
+
+        // Cheap pre-scan: does THIS class contain anything we would touch?
+        // (elision targets live anywhere; probes target this class)
+        boolean[] hit = { false };
+        String dottedInternal = internal.replace('/', '.');
+        cr.accept(new ClassVisitor(Opcodes.ASM9) {
+            @Override
+            public MethodVisitor visitMethod(int access, String name, String desc,
+                                             String signature, String[] exceptions) {
+                if (!hit[0] && config.probes().stream()
+                        .anyMatch(k -> k.equals(OptimizerConfig.key(dottedInternal, name)))) {
+                    hit[0] = true;
+                }
+                return new MethodVisitor(Opcodes.ASM9) {
+                    @Override
+                    public void visitMethodInsn(int opcode, String owner, String mname,
+                                                String mdesc, boolean iface) {
+                        if ("V".equals(Type.getReturnType(mdesc).getDescriptor())
+                                && config.elisions().contains(OptimizerConfig.key(
+                                        owner.replace('/', '.'), mname))) {
+                            hit[0] = true;
+                        }
+                    }
+                };
+            }
+        }, 0);
+        if (!hit[0]) {
+            return null;
+        }
+
+        ClassWriter cw = new ClassWriter(cr, ClassWriter.COMPUTE_FRAMES);
+        ClassVisitor chain = cw;
+        if (matchesAny(internal, config.probes())) {
+            chain = new ProbeVisitor(chain, internal, config);
+        }
+        if (!config.elisions().isEmpty()) {
+            chain = new ElisionVisitor(chain, config);
+        }
+        cr.accept(chain, 0);
+        return cw.toByteArray();
+    }
+
+    static boolean matchesAny(String internalName, Set<String> ruleKeys) {
+        // rules use dotted owner names; convert our internal name once
+        String dotted = internalName.replace('/', '.');
+        for (String key : ruleKeys) {
+            int lastDot = key.lastIndexOf('.');
+            if (lastDot <= 0) {
+                continue;
+            }
+            String owner = key.substring(0, lastDot);
+            if (dotted.equals(owner) || dotted.startsWith(owner + "$")) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    static boolean elides(String ownerInternal, String name, OptimizerConfig cfg) {
+        return cfg.elisions().contains(OptimizerConfig.key(ownerInternal, name));
+    }
+
+    static String probeTag(String internalOwner, String name) {
+        return internalOwner.replace('/', '.') + "." + name;
+    }
+
+    static final class ElisionVisitor extends ClassVisitor {
+        private final OptimizerConfig cfg;
+
+        ElisionVisitor(ClassVisitor next, OptimizerConfig cfg) {
+            super(Opcodes.ASM9, next);
+            this.cfg = cfg;
+        }
+
+        @Override
+        public MethodVisitor visitMethod(int access, String name, String desc,
+                                         String signature, String[] exceptions) {
+            MethodVisitor mv = super.visitMethod(access, name, desc, signature, exceptions);
+            return new MethodVisitor(Opcodes.ASM9, mv) {
+                @Override
+                public void visitMethodInsn(int opcode, String owner, String mname,
+                                            String mdesc, boolean isInterface) {
+                    if (!"V".equals(Type.getReturnType(mdesc).getDescriptor())
+                            || !cfg.elisions().contains(OptimizerConfig.key(
+                                    owner.replace('/', '.'), mname))) {
+                        super.visitMethodInsn(opcode, owner, mname, mdesc, isInterface);
+                        return;
+                    }
+                    // emit argument pops (receiver already on stack for non-static)
+                    Type[] args = Type.getArgumentTypes(mdesc);
+                    if (opcode != Opcodes.INVOKESTATIC) {
+                        super.visitInsn(Opcodes.POP); // receiver
+                    }
+                    for (int i = args.length - 1; i >= 0; i--) {
+                        super.visitInsn(args[i].getSize() == 2
+                                ? Opcodes.POP2 : Opcodes.POP);
+                    }
+                }
+            };
+        }
+    }
+
+    static final class ProbeVisitor extends ClassVisitor {
+        private final String dottedOwner;
+        private final OptimizerConfig cfg;
+
+        ProbeVisitor(ClassVisitor next, String ownerInternal, OptimizerConfig cfg) {
+            super(Opcodes.ASM9, next);
+            this.dottedOwner = ownerInternal.replace('/', '.');
+            this.cfg = cfg;
+        }
+
+        @Override
+        public MethodVisitor visitMethod(int access, String name, String desc,
+                                         String signature, String[] exceptions) {
+            MethodVisitor mv = super.visitMethod(access, name, desc, signature, exceptions);
+            boolean probed = cfg.probes().stream()
+                    .anyMatch(k -> k.equals(OptimizerConfig.key(dottedOwner, name)));
+            if (!probed || (access & Opcodes.ACC_ABSTRACT) != 0
+                    || "<init>".equals(name) || "<clinit>".equals(name)) {
+                return mv;
+            }
+            return new MethodVisitor(Opcodes.ASM9, mv) {
+                @Override
+                public void visitCode() {
+                    super.visitCode();
+                    super.visitLdcInsn(probeTag(dottedOwner, name));
+                    super.visitMethodInsn(Opcodes.INVOKESTATIC,
+                            "aprism/agent/optimize/ProbeSink",
+                            "methodEnter", "(Ljava/lang/String;)V", false);
+                }
+            };
+        }
+    }
+}

aprismate-agent/src/main/java/aprism/agent/optimize/BytecodeCache.java

@@ -0,0 +1,96 @@
+package aprism.agent.optimize;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.StandardCopyOption;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.util.Arrays;
+import java.util.HexFormat;
+
+/**
+ * Disk cache for transformed bytecode: ~/.aprismate/bytecode-cache by
+ * default, keyed by sha256(className + configFingerprint + inputBytes).
+ * Atomic writes (temp + move) keep concurrent readers safe; any read
+ * failure degrades to a miss.
+ */
+public final class BytecodeCache {
+
+    private final Path dir;
+
+    public BytecodeCache(Path dir) {
+        this.dir = dir;
+    }
+
+    public byte[] get(String key) {
+        Path f = fileFor(key);
+        byte[] blob;
+        try {
+            blob = Files.readAllBytes(f);
+        } catch (IOException e) {
+            return null;
+        }
+        if (blob.length < HASH_LEN) {
+            return null;
+        }
+        byte[] storedHash = Arrays.copyOfRange(blob, 0, HASH_LEN);
+        byte[] payload = Arrays.copyOfRange(blob, HASH_LEN, blob.length);
+        if (!MessageDigest.isEqual(storedHash, sha256Of(payload))) {
+            return null;
+        }
+        return payload;
+    }
+
+    public void put(String key, byte[] bytes) {
+        try {
+            Files.createDirectories(dir);
+            byte[] out = new byte[HASH_LEN + bytes.length];
+            System.arraycopy(sha256Of(bytes), 0, out, 0, HASH_LEN);
+            System.arraycopy(bytes, 0, out, HASH_LEN, bytes.length);
+            Path tmp = Files.createTempFile(dir, "t-", ".cls");
+            Files.write(tmp, out);
+            Files.move(tmp, fileFor(key), StandardCopyOption.REPLACE_EXISTING,
+                    StandardCopyOption.ATOMIC_MOVE);
+        } catch (IOException ignored) {
+            // cache is best-effort
+        }
+    }
+
+    private static final int HASH_LEN = 32;
+
+    private static byte[] sha256Of(byte[] data) {
+        var md = digest();
+        md.update(data);
+        return md.digest();
+    }
+
+    private Path fileFor(String key) {
+        return dir.resolve(sha256(key) + ".cls");
+    }
+
+    static String sha256(String s) {
+        try {
+            MessageDigest md = MessageDigest.getInstance("SHA-256");
+            return HexFormat.of().formatHex(md.digest(s.getBytes(java.nio.charset.StandardCharsets.UTF_8)));
+        } catch (NoSuchAlgorithmException e) {
+            throw new IllegalStateException(e);
+        }
+    }
+
+    static String cacheKey(String className, String fingerprint, byte[] input) {
+        String base = className + '\0' + fingerprint + '\0' + input.length + '\0';
+        var md = digest();
+        md.update(base.getBytes(java.nio.charset.StandardCharsets.UTF_8));
+        md.update(input);
+        return HexFormat.of().formatHex(md.digest());
+    }
+
+    private static MessageDigest digest() {
+        try {
+            return MessageDigest.getInstance("SHA-256");
+        } catch (NoSuchAlgorithmException e) {
+            throw new IllegalStateException(e);
+        }
+    }
+}